Be sure to return $response value when bailing from edit lock heartbeat check

Failure to do so can break other heartbeat actions on the page
Better 'create' permissions checks. Fixes #394